taskqueue-toolkit 0.1.0__py3-none-any.whl → 0.1.1__py3-none-any.whl

taskqueue_toolkit/queue/sns.py

@@ -6,10 +6,13 @@ import logging
 from collections.abc import AsyncIterator, Callable
 from contextlib import AbstractAsyncContextManager, asynccontextmanager
 from dataclasses import dataclass, field
+from typing import TYPE_CHECKING
 
 import aioboto3
-from types_aiobotocore_sns.client import SNSClient
-from types_aiobotocore_sqs.client import SQSClient
+
+if TYPE_CHECKING:
+    from types_aiobotocore_sns.client import SNSClient
+    from types_aiobotocore_sqs.client import SQSClient
 
 from taskqueue_toolkit.queue.aws_session import aws_session_kwargs
 from taskqueue_toolkit.queue.dsn import SnsDsn
@@ -20,7 +23,7 @@ logger = logging.getLogger(__name__)
 _LONG_POLL_WAIT_SECONDS = 10
 _SUBSCRIBER_QUEUE_SUFFIX = "-subscriber"
 
-ClientFactory = Callable[[SnsDsn], AbstractAsyncContextManager[tuple[SNSClient, SQSClient]]]
+ClientFactory = Callable[[SnsDsn], AbstractAsyncContextManager["tuple[SNSClient, SQSClient]"]]
 
 
 @asynccontextmanager

taskqueue_toolkit/queue/sqs.py

@@ -5,10 +5,12 @@ import logging
 from collections.abc import AsyncIterator, Callable
 from contextlib import AbstractAsyncContextManager
 from dataclasses import dataclass, field
-from typing import cast
+from typing import TYPE_CHECKING, cast
 
 import aioboto3
-from types_aiobotocore_sqs.client import SQSClient
+
+if TYPE_CHECKING:
+    from types_aiobotocore_sqs.client import SQSClient
 
 from taskqueue_toolkit.queue.aws_session import aws_session_kwargs
 from taskqueue_toolkit.queue.dsn import SqsDsn
@@ -18,7 +20,7 @@ logger = logging.getLogger(__name__)
 
 _LONG_POLL_WAIT_SECONDS = 10
 
-ClientFactory = Callable[[SqsDsn], AbstractAsyncContextManager[SQSClient]]
+ClientFactory = Callable[[SqsDsn], AbstractAsyncContextManager["SQSClient"]]
 
 
 def _default_client_factory(dsn: SqsDsn) -> AbstractAsyncContextManager[SQSClient]:

taskqueue_toolkit/queue/task_queue.py

@@ -7,6 +7,12 @@ T = TypeVar("T")
 T_co = TypeVar("T_co", covariant=True)
 
 Encoder = Callable[[T], bytes]
+# SECURITY: Decoder runs on bytes received from a broker — a source outside
+# this process's control in most deployments. Using an unsafe deserializer
+# here (pickle.loads, yaml.load without SafeLoader, eval, ...) turns
+# whoever can publish to your queue/topic into someone who can run
+# arbitrary code in your consumer. Prefer a safe format (json, msgpack,
+# protobuf) unless every publisher is fully trusted.
 Decoder = Callable[[bytes], T]
 
 

{taskqueue_toolkit-0.1.0.dist-info → taskqueue_toolkit-0.1.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taskqueue-toolkit
-Version: 0.1.0
+Version: 0.1.1
 Summary: Broker-agnostic async task queue (RabbitMQ, SQS, SNS, Redis Streams, Pub/Sub) with a Postgres outbox pattern
 Author: Walid Boughdiri
 Author-email: Walid Boughdiri <walid.boughdiri@gmail.com>
@@ -152,6 +152,12 @@ Each adapter constructor takes an injectable client/connection factory for exact
 
 Create one broker instance per test — each owns its own isolated in-memory state, so there's nothing to reset between tests and no risk of one test's queue leaking into another's.
 
+## Security
+
+`Decoder[T]` runs on bytes received from a broker — in most deployments, a source outside this process's control. Using an unsafe deserializer (`pickle.loads`, `yaml.load` without `SafeLoader`, `eval`, ...) as your `decode` callback means whoever can publish to your queue/topic can run arbitrary code in your consumer. Use a safe format (JSON, msgpack, protobuf, ...) unless every publisher is fully trusted.
+
+This package's own code is checked on every push/PR and before every release via [bandit](https://bandit.readthedocs.io/) (unsafe code patterns) and [pip-audit](https://github.com/pypa/pip-audit) (known CVEs in resolved dependencies), alongside ruff, mypy, and the test suite. Found a vulnerability? Please open an issue.
+
 ## Development
 
 ```bash
@@ -160,4 +166,6 @@ uv run pytest
 uv run ruff check .
 uv run ruff format .
 uv run mypy .
+uvx bandit -r src/
+uvx pip-audit --path .venv
 ```

{taskqueue_toolkit-0.1.0.dist-info → taskqueue_toolkit-0.1.1.dist-info}/RECORD

@@ -12,16 +12,16 @@ taskqueue_toolkit/queue/pubsub.py,sha256=btCmGr0s6TG6pgkEvV_vgKJMYyhqD8YoQ_ez_da
 taskqueue_toolkit/queue/rabbitmq.py,sha256=EKfbYsOhbrpsQ25qNO6_B2Ljw3x37qYTzIw7KZcb8ts,2841
 taskqueue_toolkit/queue/redis_streams.py,sha256=0M5JJ9ong9AN4OklsddhoxZwco7vHJYKHr2gehoLfaU,4566
 taskqueue_toolkit/queue/registry.py,sha256=ylXRKCoLvgPe6zWNs9S8HqJ9ta6-Ggb2p8crFqLAZks,2063
-taskqueue_toolkit/queue/sns.py,sha256=s-xUDNegjON_dVt9nH4BzE4iJnHVnbHg5LhxB67p9t4,6394
-taskqueue_toolkit/queue/sqs.py,sha256=xIqNeCWjw79zgxTO-tJr5z5FLQ5k0jUPs0W4KiOwpI0,3955
-taskqueue_toolkit/queue/task_queue.py,sha256=T7CTpvOUHhU5A0T5qc806cJTg9QI8SxjAnh0HJaTxAk,2414
+taskqueue_toolkit/queue/sns.py,sha256=S1PC0cFMY2rosxW-vrfVbA6qe5pmgKrZQStc83iBuzA,6456
+taskqueue_toolkit/queue/sqs.py,sha256=gIO4CNAScRo1p7rxRkxZjnjyk6IcL1bo1SN-UH_1T4Q,3995
+taskqueue_toolkit/queue/task_queue.py,sha256=xhqeLr4GxiQj_iAwxCLfT3FAhtcJZXoFA1jxcyCTrgY,2828
 taskqueue_toolkit/testing/__init__.py,sha256=7pg6csGeC-X-RN4q9bTcNQGzfmwk2leK7rTmD-aQmmI,2292
 taskqueue_toolkit/testing/pubsub.py,sha256=BFZs1MIYvJqznZ3FUSjwtJbLuzWTMUCGd2C5T2ZfvQc,4936
 taskqueue_toolkit/testing/rabbitmq.py,sha256=pV20m7mHLXfaEP6nm5QR00VdYsm4wzZYQArzcSX0u6Y,4125
 taskqueue_toolkit/testing/redis_streams.py,sha256=jBYBwVay0MVHEbcSGcBL_F4PB4X4JemDHpHQkM05eCs,5284
 taskqueue_toolkit/testing/sns.py,sha256=4YviIp20jMLyJFYPcsfCXe6aDzCbhtHbtnShhFEf-BA,5756
 taskqueue_toolkit/testing/sqs.py,sha256=a7vR9tYJlu08OpEroIAyQVWubD8UBHs8buKIyDSDSiE,4046
-taskqueue_toolkit-0.1.0.dist-info/licenses/LICENSE,sha256=XDbMvYj2p3w41uQF87jluQnQa74jSKmlpLhIsDdatQw,11346
-taskqueue_toolkit-0.1.0.dist-info/WHEEL,sha256=4OL6Foqnnp3xRY5wMkjgc25_i5YJC6dKsC6LPcjqEoU,80
-taskqueue_toolkit-0.1.0.dist-info/METADATA,sha256=4QlxVvKliEbrHDZr_Jn81j2L8OFzdpkaMxfOginEL6s,8888
-taskqueue_toolkit-0.1.0.dist-info/RECORD,,
+taskqueue_toolkit-0.1.1.dist-info/licenses/LICENSE,sha256=XDbMvYj2p3w41uQF87jluQnQa74jSKmlpLhIsDdatQw,11346
+taskqueue_toolkit-0.1.1.dist-info/WHEEL,sha256=4OL6Foqnnp3xRY5wMkjgc25_i5YJC6dKsC6LPcjqEoU,80
+taskqueue_toolkit-0.1.1.dist-info/METADATA,sha256=GqcucH9lD2rfItGKBp7PKQOXGuKxOaz5yWVyu_-hhuA,9683
+taskqueue_toolkit-0.1.1.dist-info/RECORD,,